How severe is CVE-2019-5672?

CVE-2019-5672 has a CVSS 3.x base score of 9.1, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability none.

Is CVE-2019-5672 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (69th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2019-5672?

CVE-2019-5672 primarily affects Nvidia Jetson Tx1. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2019-5672?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

When was CVE-2019-5672 published?

CVE-2019-5672 was published on 2019-04-11 and last updated on 2026-06-17.

CVE-2019-5672

CVE-2019-5672 is a critical-severity vulnerability in Nvidia Jetson Tx1 with a CVSS 3.x base score of 9.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-320.

Key facts

Severity: Critical (CVSS 3.x base score 9.1)
CVSS v2: 6.4
EPSS exploit prediction: 1% (69th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-320
Affected product: Nvidia Jetson Tx1
Published: 2019-04-11
Last modified: 2026-06-17

Description

NVIDIA Jetson TX1 and TX2 contain a vulnerability in the Linux for Tegra (L4T) operating system (on all versions prior to R28.3) where the Secure Shell (SSH) keys provided in the sample rootfs are not replaced by unique host keys after sample rootsfs generation and flashing, which may lead to information disclosure.

Frequently asked questions

What is CVE-2019-5672?: NVIDIA Jetson TX1 and TX2 contain a vulnerability in the Linux for Tegra (L4T) operating system (on all versions prior to R28.3) where the Secure Shell (SSH) keys provided in the sample rootfs are not replaced by unique host keys after sample rootsfs generation and flashing, which may lead to information disclosure.
How severe is CVE-2019-5672?: CVE-2019-5672 has a CVSS 3.x base score of 9.1, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability none.
Is CVE-2019-5672 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (69th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2019-5672?: CVE-2019-5672 primarily affects Nvidia Jetson Tx1. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2019-5672?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
When was CVE-2019-5672 published?: CVE-2019-5672 was published on 2019-04-11 and last updated on 2026-06-17.

References

https://nvidia.custhelp.com/app/answers/detail/a_id/4787

Affected products (2)

cpe:2.3:a:nvidia:jetson_tx1:*:*:*:*:*:*:*:*
cpe:2.3:a:nvidia:jetson_tx2:*:*:*:*:*:*:*:*

More vulnerabilities in Nvidia Jetson Tx1

CVE-2017-1000251 — High (CVSS 8.0): The native Bluetooth stack in the Linux Kernel (BlueZ), starting at the Linux kernel version 2.6.32 and up to and…
CVE-2021-23217 — High (CVSS 7.5): NVIDIA GPU and Tegra hardware contain a vulnerability in the internal microcontroller, which may allow a user with…
CVE-2021-23201 — High (CVSS 7.5): NVIDIA GPU and Tegra hardware contain a vulnerability in an internal microcontroller, which may allow a user with…
CVE-2018-3639 — Medium (CVSS 5.5): Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the…
CVE-2021-34400 — Medium (CVSS 4.1): NVIDIA GPU and Tegra hardware contain a vulnerability in the internal microcontroller which may allow a user with…
CVE-2021-34399 — Medium (CVSS 4.1): NVIDIA GPU and Tegra hardware contain a vulnerability in the internal microcontroller which may allow a user with…

All CVEs affecting Nvidia Jetson Tx1 →

Other CWE-320 vulnerabilities

CVE-2016-10467 — Critical (CVSS 9.8): In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile SD…
CVE-2016-10421 — Critical (CVSS 9.8): In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206,…
CVE-2018-0124 — Critical (CVSS 9.8): A vulnerability in Cisco Unified Communications Domain Manager could allow an unauthenticated, remote attacker to…
CVE-2015-0936 — Critical (CVSS 9.8): Ceragon FibeAir IP-10 have a default SSH public key in the authorized_keys file for the mateidu user, which allows…
CVE-2015-4166 — Critical (CVSS 9.8): Cloudera Key Trustee Server before 5.4.3 does not store keys synchronously, which might allow attackers to have…
CVE-2024-36391 — Critical (CVSS 9.1): MileSight DeviceHub - CWE-320: Key Management Errors may allow Authentication Bypass and Man-In-The-Middle Traffic

Browse all CWE-320 vulnerabilities →